CVE-2024-9195
Published: 28 February 2025
Summary
CVE-2024-9195 is a high-severity Missing Authorization (CWE-862) vulnerability in Whmpress Whmcs Client Area. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 27.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2024-9195 is a privilege escalation vulnerability in the WHMPress - WHMCS Client Area plugin for WordPress, stemming from a missing capability check in the update_settings case of the /admin/ajax.php file. This flaw affects all versions up to and including 4.3-revision-3, allowing unauthorized modification of WordPress site options. Classified under CWE-862 (Missing Authorization) with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), it enables attackers to alter core site configurations without proper permissions.
Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By sending crafted requests to the affected endpoint, they can update arbitrary WordPress options, such as changing the default user role for new registrations to administrator and enabling user registration. This allows attackers to self-register with administrative privileges, potentially leading to full site compromise including data exfiltration, further malware deployment, or complete control over the WordPress instance.
Advisories from Wordfence detail the vulnerability and recommend updating to a patched version beyond 4.3-revision-3, as referenced in their threat intelligence report. The plugin's Codecanyon page provides additional context on the WHMPress addon. Security practitioners should scan environments for the vulnerable plugin versions, enforce least-privilege access for subscribers, and monitor for suspicious option updates in the WordPress database.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53962
Vulnerability details
The WHMPress - WHMCS Client Area plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the update_settings case in the /admin/ajax.php file in all versions up…
more
to, and including, 4.3-revision-3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization in public-facing WordPress plugin directly enables remote authenticated privilege escalation to admin via option manipulation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the missing capability check by enforcing approved authorizations to prevent unauthorized modification of WordPress options via the plugin's AJAX endpoint.
Enforces least privilege to restrict subscriber-level users from escalating privileges by altering default registration roles or enabling user registration.
Remediates the specific flaw in WHMPress plugin versions up to 4.3-revision-3 by identifying and applying timely patches to eliminate the authorization bypass.